Remark 3.5 For some of our applications (and for simplicity of proofs), we will actually require an rTCF that is perfectly correct, which means that the correctness properties (a) and (b) hold with probability 1. That is, they hold for all \((\mathsf {pk},\mathsf {sk}) \in \mathsf {Gen}(\mathsf {injective},1^\lambda )\)  and \((\mathsf {pk},\mathsf {sk})\in \mathsf {Gen}(\mathsf {2}\text{-}\mathsf {to}\text{-}\mathsf {1},1^\lambda )\)  respectively. We briefly argue that this is possible. In the injective mode case, this is possible because the sampling procedure for injective keys given in [1]} can determine whether the key it sampled is indeed injective and if not, output a fixed hard-coded injective key. In the 2-to-1 mode case, the sampling procedure given in [2]} is perfect except for when \(s = 0^n\) . Thus, we can again hard-code a fixed 2-to-1 key to output instead whenever \(s = 0^n\) .

